dap 0.1.9 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 509c4659bddb3d19bd03810c38d9b7210a40f137
-  data.tar.gz: 856444fb5a3a6352bdedd975fe47898c98eae2d0
+  metadata.gz: 6991fe2ebe6781802697f56a62a1a83dd5bbb83b
+  data.tar.gz: 8e6aef8bd4a882c6bbd0b0563926e00127079b91
 SHA512:
-  metadata.gz: e6b147d71d185f1fc4f55582cdcde9d026d3421f2dd0fda0b3e48106d380c1049efd8fc3fb9ea2d5c189c59ed66f8db2929a944fe883e5f347a79ddf5440998e
-  data.tar.gz: 2ca8a31ca56632bc319a1201787729ba7b3845ed55cc2e1126fc519a8effef604460e85af3a32741453d68659e27126bb7c09063648741761ef64795b0aeefac
+  metadata.gz: c9a979ee64979cae1d6dafa3ec261064ed67f69150fe2fe5ba3f045f01404b07bbb55da9bdc48d8f6b741cd899a25ee89536d58816ef1f1cbfee6da2c21dd65c
+  data.tar.gz: 4ba074456d6c4e4ac1503e8f9126cede1f2fbefa199f7a39e3071d101c6d86c3f4af42b65b6d438d7d31fdc8970825e62c915cb9a75f264314d930db8f8c14f9

data/lib/dap/filter/udp.rb

@@ -38,19 +38,40 @@ end
 #
 # Decode a DNS bind.version probe response ( zmap: dns_53.pkt )
 #
+# Note: The TCP DNS response contains two additional bytes at the beginning
+# of the data which indicate length.  Net::DNS::Packet doesn't handle this
+# so we've implemented a fall back that will retry parsing with the first two
+# bytes removed if the initial parsing attempt raises an exception.
+#
 class FilterDecodeDNSVersionReply
   include BaseDecoder
   def decode(data)
     begin
       r = Net::DNS::Packet.parse(data)
-      return if not r
+    rescue
+      r = nil
+    end
 
+    unless r
+      begin
+        # Perhaps a TCP DNS response, trim the first two bytes (length value)
+        # and try again..
+        trimmed_data = data[2..-1]
+        r = Net::DNS::Packet.parse(trimmed_data)
+      rescue
+        return {}
+      end
+    end
+
+    return {} unless r
+
+    begin
       # XXX: This can throw an exception on bad data
       vers = r.answer.map{|x| x.txt.strip rescue nil }.reject{|x| x.nil? }.first
-      return if not vers
-      return { "dns_version" => vers }
+      return {} unless vers
+      return { 'dns_version' => vers }
     rescue ::Exception
-      { }
+      {}
     end
   end
 end

data/lib/dap/version.rb

@@ -1,3 +1,3 @@
 module Dap
-  VERSION = "0.1.9"
+  VERSION = "0.1.10"
 end

data/spec/dap/filter/udp_filter_spec.rb

@@ -0,0 +1,39 @@
+describe Dap::Filter::FilterDecodeDNSVersionReply do
+  describe '.decode' do
+
+    let(:filter) { described_class.new([]) }
+
+    context 'parsing empty string' do
+      let(:decode) { filter.decode('') }
+      it 'returns an empty hash' do
+        expect(decode).to eq( {} )
+      end
+    end
+
+    base64_string = "AF8074UAAAEAAQABAAAHVkVSU0lPTgRCSU5EAAAQAAPADAAQAAMAAAAAACcmOS44LjJyYzEtUmVkSGF0LTkuOC4yLTAuMzcucmMxLmVsNl83LjXADAACAAMAAAAAAALADA=="
+    test_string = base64_string.to_s.unpack('m*').first
+
+    context 'parsing a partial response' do
+      let(:decode) { filter.decode(test_string[2..10]) }
+      it 'returns an empty hash' do
+        expect(decode).to eq( {} )
+      end
+    end
+
+    context 'parsing TCP DNS response' do
+      let(:decode) { filter.decode(test_string) }
+      it 'returns the correct version' do
+        expect(decode).to eq({ 'dns_version' => '9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.5' })
+      end
+    end
+
+    # strip the first two bytes from the TCP response to mimic a UDP response
+    context 'parsing UDP DNS response' do
+      let(:decode) { filter.decode(test_string[2..-1]) }
+      it 'returns the correct version' do
+        expect(decode).to eq({ 'dns_version' => '9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.5' })
+      end
+    end
+
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dap
 version: !ruby/object:Gem::Version
-  version: 0.1.9
+  version: 0.1.10
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-01 00:00:00.000000000 Z
+date: 2017-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -223,6 +223,7 @@ files:
 - spec/dap/filter/http_filter_spec.rb
 - spec/dap/filter/ldap_filter_spec.rb
 - spec/dap/filter/simple_filter_spec.rb
+- spec/dap/filter/udp_filter_spec.rb
 - spec/dap/input/json_spec.rb
 - spec/dap/proto/ipmi_spec.rb
 - spec/dap/proto/ldap_proto_spec.rb
@@ -260,6 +261,7 @@ test_files:
 - spec/dap/filter/http_filter_spec.rb
 - spec/dap/filter/ldap_filter_spec.rb
 - spec/dap/filter/simple_filter_spec.rb
+- spec/dap/filter/udp_filter_spec.rb
 - spec/dap/input/json_spec.rb
 - spec/dap/proto/ipmi_spec.rb
 - spec/dap/proto/ldap_proto_spec.rb